Sample deliverable · $99 Email & DNS Safety Check

What your report actually looks like.

One page, plain English, every finding labelled. Below is the full structure you get — filled with a fictional clinic so you can see the wording.

This is an illustrative sample. “Harbourview Animal Clinic” and harbourview.example are fictional. Real client reports contain their actual DNS records and are confidential.

Email & DNS safety check

Harbourview Animal Clinic

Prepared for: front desk owner · Date: 2026-10-20 · Domain: harbourview.example
Scope: public DNS records only. No website connection, no login, no port scan, no changes.

What I checked

MX records (where your email is delivered), SPF (which servers may send as your domain), DKIM (message signing), DMARC (what receivers do with unauthenticated mail), DNSSEC (DNS answer integrity), CAA (which certificate authorities may issue certificates for your website), and MTA-STS/TLS-RPT (mail transport policy and reporting).

Findings

#	Finding	Status	Why it matters	Suggested first step
1	No DMARC policy: anyone can send email that appears to come from `@harbourview.example`	Confirmed	Phishers routinely impersonate clinics (“appointment reminder — click to confirm”). DMARC is what lets mail servers reject those fakes.	Publish a DMARC record in monitoring mode; review reports for 2–4 weeks.
2	SPF ends in `~all` (soft fail) and lists one sender	Confirmed	Not wrong by itself, but combined with no DMARC it gives receivers no policy to enforce.	Fix together with DMARC in step 1. No separate change needed yet.
3	No DKIM selector found among common provider selectors	Needs validation	A missing public selector is not proof DKIM is absent — your provider may use a custom one.	Confirm with your email provider; I verify during the fix session if you book one.
4	No CAA record	Confirmed	Low urgency. A CAA record limits which companies can issue certificates for your domain.	Optional; can add when the higher-priority records are in place.
5	MTA-STS / TLS-RPT not published	Not applicable	Only meaningful once SPF and DKIM are aligned; adding it early provides no benefit.	Revisit after step 1.

What this means

One confirmed issue is worth fixing: your domain currently has no DMARC policy, which means email can be sent to your clients and suppliers that appears to come from you. This does not mean your email account was compromised or that your website has a problem — it is a missing public record, not evidence of a break-in. Two other items are confirmed but low urgency, and one needs a quick check with your email provider before I can call it.

Fix first

Publish DMARC in monitoring mode (p=none with reporting), alongside SPF as-is. Watch the reports for 2–4 weeks.
Then tighten: once SPF and DKIM alignment is verified by the reports, move to a quarantine or reject policy. Moving straight to p=reject without this step can block your legitimate mail — I won't recommend it until the data supports it.

What I did not test

Mailbox access or mail flow, sending reputation or blocklist status
Provider-side settings not visible in public DNS
Website security, logins, booking, payment, or client data
Anything requiring your written consent and, where relevant, your agency's authorization

Limits

This is a public-DNS review — not a penetration test, not a compliance certification, and not a guarantee that the domain cannot be spoofed. Findings are best-effort and labelled by confidence.

This check includes the report and a 20-minute call. If you'd like the website layer too, the $199 review adds the public website checks — and the $99 fee counts toward it. The review fee is credited toward any fix booked within 30 days.

Adam Ramoul · 905-616-5021 · consent-first, non-invasive reviews

Remember: the clinic and domain on this page are fictional. Your real report contains your actual records. Back to home · Call or text 905-616-5021